<html>
<head><meta charset="utf-8"><title>send-sync-trait-bounds · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html">send-sync-trait-bounds</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="223916201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223916201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223916201">(Jan 25 2021 at 15:53)</a>:</h4>
<p>So it's clear that a huge swath of recent rustsec reports are places where <code>Send</code> or <code>Sync</code> is implemented for a <code>struct</code> which is generic over <code>T</code>, but `T is missing the appropriate bounds.</p>
<p>Can we request a clippy lint, or a warning in rustc itself, for these cases?</p>



<a name="223916730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223916730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223916730">(Jan 25 2021 at 15:57)</a>:</h4>
<p>you need <code>unsafe</code> to implement Send or Sync, right?</p>



<a name="223916764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223916764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223916764">(Jan 25 2021 at 15:57)</a>:</h4>
<p>I don't know what the compiler can do about that, <code>unsafe</code> is making a guarentee to the compiler that you know better than it does</p>



<a name="223916902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223916902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223916902">(Jan 25 2021 at 15:58)</a>:</h4>
<p>Yeah, so maybe a clippy warning -- which you can always silence  --"if you impl Send/Sync for a type that's generic and the generic param doesn't have the trait bounds, warn"</p>



<a name="223916948"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223916948" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223916948">(Jan 25 2021 at 15:59)</a>:</h4>
<p>hmm, can you point me to an example?</p>



<a name="223917017"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223917017" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223917017">(Jan 25 2021 at 15:59)</a>:</h4>
<p><a href="https://rustsec.org/advisories/">https://rustsec.org/advisories/</a> search "bound" here :-)</p>



<a name="223917232"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223917232" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223917232">(Jan 25 2021 at 16:00)</a>:</h4>
<p>oh I see, this is specifically about implementing Sync when T is not Send</p>



<a name="223917260"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223917260" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223917260">(Jan 25 2021 at 16:00)</a>:</h4>
<p>yeah that sounds like it could use a lint</p>



<a name="223930931"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223930931" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223930931">(Jan 25 2021 at 17:23)</a>:</h4>
<p>I guess I'll go ahead and file a clippy lint request. Thanks for helping polish the idae!</p>



<a name="223931817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223931817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223931817">(Jan 25 2021 at 17:29)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust-clippy/issues/6638">https://github.com/rust-lang/rust-clippy/issues/6638</a></p>



<a name="223940374"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223940374" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223940374">(Jan 25 2021 at 18:33)</a>:</h4>
<p>cc <span class="user-mention" data-user-id="329529">@Yechan Bae</span> - perhaps this will be of interest, I believe they have also developed a tool to detect this.</p>



<a name="223941073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223941073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223941073">(Jan 25 2021 at 18:38)</a>:</h4>
<p>Indeed! If they could share whether their tool has a more sophisticated heuristic, or if they're just manually validating findings, that'd be great.</p>



<a name="223955681"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223955681" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Yechan Bae <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223955681">(Jan 25 2021 at 20:32)</a>:</h4>
<p>Thanks for a heads up, I'll take a look at the issue and leave a feedback there with <span class="user-mention" data-user-id="242132">@JOE1994</span></p>



<a name="223956187"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/223956187" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#223956187">(Jan 25 2021 at 20:36)</a>:</h4>
<p>Thank you!</p>



<a name="228794766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/228794766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#228794766">(Mar 04 2021 at 15:42)</a>:</h4>
<p>ooh <a href="https://github.com/RustSec/advisory-db/pull/807#issuecomment-790706001">https://github.com/RustSec/advisory-db/pull/807#issuecomment-790706001</a></p>



<a name="228794848"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/send-sync-trait-bounds/near/228794848" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/send-sync-trait-bounds.html#228794848">(Mar 04 2021 at 15:43)</a>:</h4>
<blockquote>
<p>we have a static analyzer implementation that can also be easily ported as a Clippy lint.<br>
We're wrapping up our work for a submission to a conference, and we plan to release the tool and the Clippy lint implementation soon :)</p>
</blockquote>
<p>sounds awesome <span class="user-mention" data-user-id="242132">@JOE1994</span> !</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>